Something similar is being done.

Or how about a few quintillion cookies?

Sometimes it isn't possible. What should someone use to buy goods that aren't sold in any store within his home town, such as electronic parts in the post-RadioShack era?

Speaker's Corner isn't anything like the out-of-sight, out-of-mind free speech zones in the United States, is it?

Gorillaz? I thought keeping the snack counter at Feel Good Inc. supplied with Milk Duds took an American Express business card.

You could implant a cryptographic radio transponder with a 666-bit keypair in people's forehead or right hand. The plus side is that it'd combine the positive aspects of a "something you have" transponder with biometrics' resistance to loss or theft. The minus side is protests from Christians who think it's the mark of the Beast mentioned in the revelation to John of Patmos.

* Actual theft, not copying.

I thought MS-DOS didn't get folders until 2.0, and Mac OS didn't get folders until HFS in System 2.1.

Then how would a reset work? Or do all subscribers to your service additionally need to subscribe to mobile phone service on a supported carrier?

My concern is how to keep someone between your server and the subscriber's MUA from compromising "possession", or how to establish "possession" the first time.

I just use a PRNG. If I need it as a GUID, I request 120 random bits and format them as a type 4 UUID. Is that good enough?

Or to put it shorter: "Passwords and password reset codes go in separate fields."

I've implemented a similar system that keeps the hashed password and the one-time-use code in separate fields of the user table. I just wondered if there was any good way to protect the "login ticket" (the mail containing the one-time-use code) from interception in the 24 hours between when it is sent and the expiration time that we store.

This use of a one-time, soon-expiring autogenerated password is common in flows that include the step "To reset your password, confirm your e-mail address" or "To opt in to e-mail notifications, confirm your e-mail address". Is there an alternative, other than to either A. mail all customers a second factor of authentication used to reset a password, or B. require all customers to subscribe to mobile phone service with unlimited texting to receive resets through SMS?

How do you encrypt this unique verification URL on its way to the subscriber to your service?

I'm sorry; I misread this as "security theater questions". See "The Curse of the Secret Question" by Bruce Schneier and "Wish-It-Was Two Factor" by Alex Papadimoulis.

A lot of time, the answers to security theater questions are things that would be in a user's Facebook timeline, such as the name of the middle school that the user attended.

So how do you encrypt this UUID? And what do you send for a password reset?

But how do you send a text to the number "I don't have a cell phone" or to a land line? I tried to send the code to a land line on a couple sites and got "Unsupported carrier".